Name: Breath.345 Category: Viruses Description: Details Breath.3457 It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. On any program termination the virus searches for files and infects them. The virus does not infect several anti-viruses (see the list below). It also patches code of memory-resident TBAV anti-virus and deletes the anti-virus databases ANTI-VIR.DAT and CHKLIST.MS, if they exist. On August 7th the virus displays the message: Now is time to Breath.2 ! (DCB-1997-Romania,NOT Bulgaria ! ) Stay cool,nothing goona happen,just breath ! The virus then overwrites the MBR of the hard drive with a program that displays on system booting: Starting MS-DOSall Ce e aia , MS - DOS ? Apasati tasta ANY. The virus also contains the text strings, the second one contains parts of anti-virus filenames: TBMEMXXXTBCHKXXXTBDSKXXXTBFILXXX VDS TB RAV SCAN F- FP CLEAN MSAV NOD VS GUARD AVIX *.COM *.EXE COMMAND Breath.2!